docs: def get_selinux_status():
      """
      get SELinux status of host
  
      :return: string, one of Enforced, Permissive, Disabled
      """
      getenforce_command_exists()
      # alternatively, we could read directly from /sys/fs/selinux/{enforce,status}, but status is
      # empty (why?) and enforce doesn't tell whether SELinux is disabled or not
      o = run_cmd(["getenforce"], return_output=True).strip()  # libselinux-utils
      logger.debug("SELinux is %r", o)
      return o